Dependency & Supply-Chain Scan – Known-Vulnerable Packages in the Code You Ship

Most of the code in your product was written by strangers. This checks which of it has a known hole.

The Dependency & Supply-Chain Scan reads the dependency and lock files in a code folder you own — npm, Python, Go, Ruby, PHP, Java, Rust and .NET — and checks every package and version against the free, public OSV vulnerability database. It leads with the vulnerabilities that already have a fix you can install today, separates the packages you chose from the ones they dragged in, and never installs, runs or uploads any of your code.

What it checks

• Every dependency and lock file in the folder, across eight package ecosystems
• Each package and version against the OSV public vulnerability database
• Whether a fix exists, and whether the vulnerable package is one you chose or one that came along with it
• Missing lock files and unpinned versions that make every build a different build
• Abandoned packages, and names that impersonate popular ones
• Licence signals that a buyer or a customer's lawyer would ask about, reported as information only

What you get

• A written PDF report emailed back to you, typically within one business day.
• Every vulnerable package rated Critical / High / Medium / Low, with the version that fixes it where one exists.
• An executive summary you can hand to a client, an insurer or an acquirer asking about your software supply chain.
• Upgrade-first remediation: what to bump, in what order, and what cannot be fixed yet.
• A "what was checked" appendix that states the limits of the scan honestly.
• Reporting built to CompTIA Security+ and PenTest+ practice standards.

Who it's for

Solo developers, small product teams, and business owners who had an application built for them and want to know what it depends on. Subscription scanners charge per developer per month; this is one run and a written report.

Requirements

• Windows 10 or Windows 11
• No administrator rights needed
• An internet connection, for the vulnerability database lookups
• A local folder containing a project you own or are authorised to scan
• About 5 minutes, longer for a large monorepo

What this is not

QuickScan is detection and advisory only. It reads your dependency files; it never uploads your source code, never installs or runs a package, never tests whether a vulnerability is exploitable, and changes nothing in your project. If the vulnerability database cannot be reached, the report says the check did not run rather than reporting a clean result. It is not a certification, an audit or an attestation.

One-time purchase. No subscription, no auto-renewal. Your report is prepared with AI-assisted analysis under ThreatVector's security review protocols and checked against our false-positive triage rules before it is sent. Reports are produced by ThreatVector LLC. ThreatVector and its scan library are developed, sold and distributed by ThreatVector LLC.